Key Points
- Authorities in Singapore report approximately S$3.5 million stolen in two incidents involving modified Ledger hardware wallets purchased from physical retailers.
- Compromised units contained concealed components designed to extract users’ seed phrases and private keys.
- The French crypto wallet manufacturer halted distribution across seven Southeast Asian territories on October 13.
- Industry analysts calculate aggregate losses from affected devices exceed US$86 million, though Ledger hasn’t verified this estimate.
- Law enforcement officials recommend users adhere to manufacturer guidelines and maintain strict confidentiality of recovery credentials.
Cryptocurrency holders in Singapore have suffered losses totaling approximately S$3.5 million after purchasing modified Ledger hardware wallets from brick-and-mortar retail locations.
The Singapore Police Force disclosed this information in an official statement released on October 28. Authorities confirmed receiving two separate reports concerning the Paris-headquartered firm’s products beginning September 10.
Hardware wallets function as physical storage devices for private cryptographic keys, maintaining them in an offline environment. This design philosophy traditionally offers enhanced security compared to internet-connected storage solutions vulnerable to remote attacks.
Malicious Components Discovered in Physical Devices
Preliminary findings from ongoing investigations revealed that specific Ledger units distributed through certain Singapore retail establishments had been fitted with unauthorized hardware modifications. Law enforcement officials indicated these embedded components possessed the capability to intercept and record users’ recovery phrases and private cryptographic keys.
Possession of this sensitive information would enable malicious actors to gain unauthorized access to victims’ cryptocurrency holdings. Perpetrators could subsequently transfer digital assets without the legitimate owner’s knowledge or consent.
Authorities confirmed they maintain active communication with Ledger, which continues examining the reported incidents.
The Straits Times reported that one tainted device originated from Metapod, located within Changi Airport’s retail area. A second compromised unit was allegedly purchased from a Challenger electronics store situated in VivoCity shopping center.
These incidents emerged following Ledger’s earlier investigation into products distributed through CryptoBilis, a regional reseller operating throughout Southeast Asia. The company verified discovering a concealed hardware modification in one wallet on October 10.
Ledger’s specialized Donjon security division identified that the implant could intercept the 24-word recovery phrase displayed during initial device configuration. The component then transmitted this sensitive data to attackers via an embedded LTE cellular modem.
The manufacturer clarified that the malicious addition operated independently from the Secure Element—the dedicated chip responsible for safeguarding private keys. Ledger emphasized that its internal systems and direct-to-consumer distribution channels remained uncompromised.
Company Implements Regional Distribution Freeze
On October 13, Ledger instructed all authorized resellers and distributors to immediately cease sales and shipments of its wallet products throughout Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong.
The company advised individuals who acquired devices from CryptoBilis within the preceding 90-day period to refrain from initializing any unopened wallets. Users who had previously activated such devices received recommendations to migrate their cryptocurrency holdings to fresh wallets secured with newly generated recovery phrases.
Blockchain security researchers have calculated that total losses connected to the compromised wallet devices surpass US$86 million. Ledger representatives stated they cannot authenticate this aggregate figure or determine the precise number of affected individuals. The Singapore police statistics encompass only domestically reported cases.
The security concerns have extended beyond Asia. On October 13, German electronics retailer MediaMarktSaturn temporarily suspended Ledger product sales following a customer’s discovery of an unauthorized component within a purchased device. Ledger confirmed no financial losses occurred in that particular instance.
On October 26, competing hardware wallet manufacturer Keystone revealed a distinct security incident that compromised personal information belonging to 25,964 customers. Keystone assured users that recovery phrases and private keys remained secure, though the company destroyed 18,835 wallet units and temporarily halted distribution operations.
Singapore authorities indicated their investigation remains active. They encouraged cryptocurrency users to carefully observe official security guidance issued by wallet manufacturers and emphasized the critical importance of never disclosing private keys, recovery phrases, or seed phrases under any circumstances.
Individuals possessing relevant information may contact the police assistance line at 1800-255-0000 or provide details through the online portal at www.police.gov.sg/i-witness.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
